Re: [sidr] comments on draft-ymbk-sidr-transfer-01???

[Geoff Huston <[e-mail]>]

> On 8 Oct 2015, at 2:56 PM, Sandra Murphy <[e-mail]> wrote:
> 
> The draft draft-ietf-sidr-rpki-validation-reconsidered speaks forcefully of the potential for damage if a certificate over claims, i.e., claims more resources than its parent.  The draft discusses how that could result from a failure of timing in a transfer of resources.

** or form any other form of a drop in precise synchronisation between the CA’s number resource database and the state of a CA’s issued certificates.

While I’m sure perfection is an admirable objective, snafus do occur, and another part of the motivation of the reconsidered document was to reduce degree of catastrophic result from certain forms of certificate issuance failure from one where all subordinate certificates cannot be validated to one that impacts only of the validation status relative to the resource that was placed in this inconsistent state.

i.e. validation reconsidered is not 1:1 isomorphic to just transfers, as you may have been led to believe from the next sentence...


> 
> In a presentation in the November 2014 IETF session on this topic, it was suggested that discussion of "a standard procedure for certificate management during resource transfer” and "current CA operational procedures for managing transfers” would help in the reconsideration of the validation algorithm.
> 


regards,

   Geoff